11package cloud
22
33import (
4+ "encoding/json"
5+ "errors"
46 "fmt"
7+ "os"
8+ "strings"
59
10+ "github.com/aws/aws-sdk-go/aws"
611 aws_sdk "github.com/aws/aws-sdk-go/aws"
712 "github.com/aws/aws-sdk-go/aws/session"
813 "github.com/aws/aws-sdk-go/service/ec2"
14+ "github.com/aws/aws-sdk-go/service/kms"
915 "github.com/aws/aws-sdk-go/service/sts"
1016 "github.com/onsi/ginkgo/v2/dsl/core"
1117
1218 "github.com/mongodb/mongodb-atlas-kubernetes/pkg/util/toptr"
13- "github.com/mongodb/mongodb-atlas-kubernetes/test/e2e/api/aws "
19+ "github.com/mongodb/mongodb-atlas-kubernetes/test/e2e/config "
1420)
1521
1622type AwsAction struct {
@@ -25,13 +31,136 @@ type awsNetwork struct {
2531 Subnets []* string
2632}
2733
28- func NewAwsAction () * AwsAction {
29- return new ( AwsAction )
34+ type principal struct {
35+ AWS [] string `json:"AWS,omitempty"`
3036}
3137
32- func (awsAction * AwsAction ) CreateKMS (region , atlasAccountArn , assumedRoleArn string ) (key string , err error ) {
33- session := aws .SessionAWS (region )
34- return session .GetCustomerMasterKeyID (atlasAccountArn , assumedRoleArn )
38+ type kmsPolicy struct {
39+ Version string `json:"Version"`
40+ Statement []statement `json:"Statement"`
41+ }
42+
43+ type statement struct {
44+ Sid string `json:"Sid"`
45+ Effect string `json:"Effect"`
46+ Principal principal `json:"Principal"`
47+ Action []string `json:"Action"`
48+ Resource string `json:"Resource"`
49+ }
50+
51+ func (a * AwsAction ) CreateKMS (region , atlasAccountArn , assumedRoleArn string ) (key string , err error ) {
52+ a .t .Helper ()
53+
54+ kmsClient := kms .New (a .session , aws .NewConfig ().WithRegion (config .AWSRegionUS ))
55+
56+ keyId , adminARNs , err := getKeyIDAndAdminARNs ()
57+ if err != nil {
58+ return "" , err
59+ }
60+
61+ policyString , err := rolePolicyString (atlasAccountArn , assumedRoleArn , adminARNs )
62+ if err != nil {
63+ return "" , err
64+ }
65+
66+ policyInput := & kms.PutKeyPolicyInput {
67+ KeyId : & keyId ,
68+ PolicyName : aws_sdk .String ("default" ),
69+ Policy : aws_sdk .String (policyString ),
70+ }
71+
72+ _ , err = kmsClient .PutKeyPolicy (policyInput )
73+ if err != nil {
74+ return "" , err
75+ }
76+
77+ return keyId , nil
78+ }
79+
80+ func getKeyIDAndAdminARNs () (keyID string , adminARNs []string , err error ) {
81+ keyID = os .Getenv ("AWS_KMS_KEY_ID" )
82+ if keyID == "" {
83+ err = errors .New ("AWS_KMS_KEY_ID secret is empty" )
84+ return
85+ }
86+ adminArnString := os .Getenv ("AWS_ACCOUNT_ARN_LIST" )
87+ if adminArnString == "" {
88+ err = errors .New ("AWS_ACCOUNT_ARN_LIST secret is empty" )
89+ return
90+ }
91+
92+ adminARNs = strings .Split (adminArnString , "," )
93+ if len (adminARNs ) == 0 {
94+ err = errors .New ("AWS_ACCOUNT_ARN_LIST wasn't parsed properly, please separate accounts via a comma" )
95+ return
96+ }
97+
98+ return keyID , adminARNs , nil
99+ }
100+
101+ func rolePolicyString (atlasAccountARN , assumedRoleARN string , adminARNs []string ) (string , error ) {
102+ policy := defaultKMSPolicy (atlasAccountARN , assumedRoleARN , adminARNs )
103+ byteStr , err := json .Marshal (policy )
104+ if err != nil {
105+ return "" , err
106+ }
107+ return string (byteStr ), nil
108+ }
109+
110+ func defaultKMSPolicy (atlasAccountArn , assumedRoleArn string , adminARNs []string ) kmsPolicy {
111+ return kmsPolicy {
112+ Version : "2012-10-17" ,
113+ Statement : []statement {
114+ {
115+ Sid : "Enable IAM User Permissions" ,
116+ Effect : "Allow" ,
117+ Principal : principal {
118+ AWS : []string {atlasAccountArn },
119+ },
120+ Action : []string {"kms:*" },
121+ Resource : "*" ,
122+ },
123+ {
124+ Sid : "Allow access for Key Administrators" ,
125+ Effect : "Allow" ,
126+ Principal : principal {
127+ AWS : adminARNs ,
128+ },
129+ Action : []string {
130+ "kms:Create*" ,
131+ "kms:Describe*" ,
132+ "kms:Enable*" ,
133+ "kms:List*" ,
134+ "kms:Put*" ,
135+ "kms:Update*" ,
136+ "kms:Revoke*" ,
137+ "kms:Disable*" ,
138+ "kms:Get*" ,
139+ "kms:Delete*" ,
140+ "kms:TagResource" ,
141+ "kms:UntagResource" ,
142+ "kms:ScheduleKeyDeletion" ,
143+ "kms:CancelKeyDeletion" ,
144+ },
145+ Resource : "*" ,
146+ },
147+ {
148+ Sid : "Allow use of the key" ,
149+ Effect : "Allow" ,
150+ Principal : principal {
151+ AWS : []string {assumedRoleArn },
152+ },
153+ Action : []string {
154+ "kms:Encrypt" ,
155+ "kms:Decrypt" ,
156+ "kms:ReEncrypt*" ,
157+ "kms:GenerateDataKey*" ,
158+ "kms:DescribeKey" ,
159+ },
160+ Resource : "*" ,
161+ },
162+ },
163+ }
35164}
36165
37166func (a * AwsAction ) GetAccountID () (string , error ) {
0 commit comments